Answer the question directly: say whether AI coding assistants are used, where, and under what rules. Then cover four controls: human review of all changes, the same scanning on AI-written code as other code, limits on what code and data can be sent to the assistant, and records of use.
Why buyers ask
They have two worries. One is quality: AI suggestions can introduce flaws or unfamiliar dependencies. The other is data: proprietary or customer information could leave your environment through a prompt. A good answer addresses both.
The four controls
Review. Every change, whoever or whatever wrote it, goes through peer review and the same merge rules. State that AI output is treated as untrusted input.
Testing. AI-assisted changes pass the same static analysis and dependency checks. A new package suggested by an assistant is checked before it is added. See questions to ask about AI coding assistants adding dependencies.
Data boundary. Say what is allowed in prompts. For example: no customer data, no secrets, and only approved assistants with agreed data terms. Name whether the vendor trains on your inputs, and cite the contract if you can.
Records. Say whether usage is logged and for how long.
Decision table: how to phrase your answer
| Your situation | Suggested phrasing |
|---|---|
| Approved assistants, rules in place | "Engineers may use approved AI coding assistants under a written policy. All changes receive human review and standard scanning." |
| Used informally, no policy yet | "Some engineers use AI assistants. We are formalising a policy, due on a stated date. Current rules are review and scanning for all changes." |
| Prohibited | "AI coding assistants are not permitted on production code. We monitor for this through a stated control." Only if enforced. |
Do not say "prohibited" unless you can show how it is enforced. Developers use these tools whether or not they are sanctioned.
What to attach
The policy page, the approved tool list, and a screenshot of the review rule. If a buyer asks for the share of AI-generated code, say you do not measure it rather than estimating.
What not to say
Do not claim AI code is "as safe as human code" or "safer". Neither can be shown from your data alone. Do not claim zero data leaves your network unless network controls prove it.
Review the answer often
This area changes quickly. New assistants, new agent features and new vendor data terms appear every few months. Put the answer on a short review cycle, and have someone check the approved tool list against what developers actually use, for example from expense records or network logs. An outdated answer here is easy for a buyer to disprove.
Quick check
Do we need to disclose AI use in our product, not only our development?
That is a separate question. Product AI features have their own questions on data use, models and subprocessors. Answer them separately.
Is a policy enough?
A policy plus one enforced control, such as mandatory review, is stronger than a policy alone.
Safeguard provides MCP Guardrail and agent identity for teams connecting AI tools to their systems, plus a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
